Community Bank AI Security Readiness Guide

When Anthropic released Claude Mythos in April, AI advanced in a way community banks can’t ignore. This cybersecurity model finds software vulnerabilities and tests attack methods with much less human intervention than earlier tools, but it’s a double-edged sword. The same AI that can help banks find and fix weak spots might also help criminals scan bank systems, vendors and connected platforms faster to find a way in.

Unlike large banks that have their own developers and software teams, community banks can’t solve this by looking only inside their own walls. They more heavily rely on vendors, which means a software weakness outside the bank can still create risk inside the bank. If the vendor doesn’t notify the bank quickly, the bank might not have enough time to protect its own systems and network.

That leaves community banks with a basic but urgent question: What do we need to know before AI changes the risk faster than our contracts, vendors and internal response plans can address those risks? ICBA recently developed the Community Bank AI Security Readiness Guide to help community banks answer that question. Created with input from members of the ICBA AI Task Force, the guide focuses on the AI security issues community banks deal with every day, including vendor dependence, board oversight, contract language, incident response planning and cyber insurance coverage.

Don’t wait on AI security

AI might already be closer to your bank than you think. Hundreds of large language models are in the market, and more will add stronger cyber capabilities over time. Community banks don’t need regulators to tell them AI security belongs on the agenda. They need to understand what’s changing, where AI touches the bank and which vendor relationships could expose them to risk.

ICBA members already know how to work through major disruptions. Many have served their communities for generations and have been through financial crises, Y2K, natural disasters and major technology changes. AI is just the latest potential disruptor community banks must address given the technology’s ability to change the speed, scope and complexity of cyber risk.

The Community Bank AI Security Readiness Guide responds to community bankers’ questions and concerns about AI by helping members understand the threat, build upon existing third-party risk management and identify specific actionable steps they can readily implement. It provides community banks with information that can help leaders prepare for briefing their boards, talking to vendors, testing incident response plans and reviewing cyber coverage before an AI-related incident occurs.

The Community Bank AI Security Readiness Guide covers problems banks might not see coming, including shadow AI, vendor-embedded AI, wearable devices and fourth-party risk.

AI security steps community banks can take now

The last thing community banks need is another abstract warning about AI. They need to know what’s coming at them, what to check first and how to react when something happens.

The Community Bank AI Security Readiness Guide covers problems banks might not see coming, including shadow AI, vendor-embedded AI, wearable devices and fourth-party risk. The guide is intended to help community bankers address many facets of AI using tools and processes they can assign, test and track.

The guide also lays out specific steps community banks can take right now, starting with the vendors that keep the bank running, including the core processor, online banking provider and major fintech partners. As explained in the guide, community bankers should be asking these vendors whether they already have AI features active in the bank’s environment, whether they’ll notify the bank before activating more, and how they’re responding to AI-driven cyber capabilities from companies like Microsoft, Anthropic and OpenAI.

Practical ways to address AI risk

Here are three more actionable steps community banks can take now to address or prepare for AI:

• Put AI risk in front of the board. AI readiness belongs at the board level, because it touches risk, technology, vendors, customers and long-term planning. Document the discussion, acknowledge the new threat environment and discuss preparations. The board conversation should cover security first, followed by how the bank can use AI responsibly to protect the institution, improve operations and serve customers. 
• Update incident response plans. AI might increase the number and speed of cyber incidents, so response plans need to account for more than one problem at a time. These could include vendor problems, branch disruptions or network concerns.
• Join an ICBA tabletop exercise. These sessions let banks test their cyber resilience and AI readiness in a controlled setting before a live incident occurs. ICBA’s last tabletop exercise with the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) drew more than 400 bankers, and participation will likely grow as AI security becomes a bigger concern. The exercises are complimentary for ICBA members.

Not just threats and risks

AI can also help community banks build solutions, identify efficiencies and improve processes. For example, they can use AI tools to support fraud prevention by reviewing documents, checks, receipts and loan materials for signs of fraud, synthetic content or AI-generated information.

AI tools can also support back-office work and improve customer service. For example, a well-managed chatbot can answer basic questions about hours, CD rates or account information, giving branch staff more face-to-face time with customers who need more than a quick answer. 

ICBA continues to build resources to support community bankers’ AI questions and needs. It currently offers three primary channels to help community banks navigate AI security readiness: education and training programs through ICBA Education (icba.org/education); access to AI fintech solutions through the ICBA ThinkTECH Accelerator within ICBA Innovation (icba.org/innovation); and ICBA Community (community.icba.org), a members-only digital platform where community bankers can share questions, experiences and lessons from the field.

The pace of change can feel overwhelming, but ICBA has your community bank’s back.